Question:
Regarding the underscore ( _ ) character, I can see words/strings that contain an underscore, however I am not receiving search results that include those examples. Why is that?
Answer:
Default dtSearch settings in Accessdata FTK have the underscore character defined as a "letter". This means that the underscore character is indexed as a literal character, rather than treated as a word-breaker.
Thus, for an FTK case using default dtSearch settings, to find a string that contains an underscore, one must include the underscore in the query.
E.g. For a string like "older_version_documentation" to be returned as a search hit, one would need to search like below:
older_version_documentation
older*
older_*
older_version*
This also means that searching for any of the following would not return "older_version_documentation" as a search hit:
older
version
documentation
older w/1 version
Note: One can change this default treatment of the underscore character during case creation.
E.g. remove the underscore from the "letters" section and add it to the "hyphen" or "space" section.
Applies To
AD Enterprise
AD Lab
FTK
Contributors: Bryan Gorczyk, Tom Angle